Microsoft/MSN Mailhosts missing IP addresses

Recommended Posts

Hi there for a couple weeks now I noticed most reporting was going to report_spam@hotmail.com. I started to get suspicious and so started looking into it. It seems as though there's some Microsoft IPv6 addresses which aren't in our "Hotmail / MSN" drop-down list of the Mailhosts section our account and every time the parser hits on one of those it decides that's the source of the spam instead of continuing through the headers to the actual origin.

I tried deleting my Hotmail/ MSN mailhost entry from within our "Mailhosts" section and recreating it didn't help. Also here's a sample of some of the IPv6 addresses that have been incorrectly identified as the source of the spam messages in some of our submissions:

Also please note that whenever all the Microsoft / MSN IPv6 addresses in the message header ARE listed in the current Microsoft / MSN dropdown those messages are correctly parsed and the source of the spam message positively identified. However this seems to be only 1 out of every 10 submissions which means I'm cancelling the reporting of 9 / 10 submissions at this point.

Share this post

Link to post

Share on other sites

The problem, petzl is not that the parser is generating a report addressed to the report_spam@hotmail.com address but that it is doing so INSTEAD of creating a report addressed to the actual ISP where the reported spam message came from, making the whole exercise relatively pointless.

What's Microsoft going to do about a spam that originally came from somewhere not in their control? Nothing. And then at the same time the ISP of the spammer isn't getting the notification it needs to take action. That's the real issue here.

For example in the link you put into your reply the origination IP address of that spam message was most likely the 74.202.231.63 IP address listed in the headers. When spamcop is parsing correctly it would most likely have found that it should address the report to security@level3.com, the abuse email address on file for the ISP in charge of that IP address. As you can see at the bottom of that parse job that's NOT where it's addressed to and that's a fail. Microsoft is not in charge of that IP address and therefore has no jurisdiction to correct the issue.

Share this post

Link to post

Share on other sites

Initially I was cancelling these but I've now realized it's possible to uncheck the report_spam@hotmail report, check the 'user report' option under it, then fill in the abuse address for the ISP who's in charge of that particular IP address.
You can find this by looking in the headers for the point at which a non-Microsoft server has handed off the messaging to a Microsoft server and running a whois on the IP address of that hand-off server. From your link above this is the relevant section:

Received: from mail1.listingbookmail.com (74.202.231.63) by
HE1EUR02FT053.mail.protection.outlook.com (10.152.11.109) with Microsoft SMTP

Doing a whois 74.202.231.63 | grep Abuse gives us the following results:

Share this post

Link to post

Share on other sites

Initially I was cancelling these but I've now realized it's possible to uncheck the report_spam@hotmail report, check the 'user report' option under it, then fill in the abuse address for the ISP who's in charge of that particular IP address.
You can find this by looking in the headers for the point at which a non-Microsoft server has handed off the messaging to a Microsoft server and running a whois on the IP address of that hand-off server. From your link above this is the relevant section:

...

So then you fill in abuse@level3.com into the blank 'user' field and submit that, instead.

HN Support,

Everyone can uncheck report_spam @ hotmail, but not everyone has the option to fill in user field. That's a spamcop premium user option.

Also, Filling in the optional user report field with the correct abuse email does not contribute to the blacklist for that spammer.

Share this post

Link to post

Share on other sites

It's open season on Hotmail users until parser gets fixed and can correctly identify source of spam.

Or Hotmail corrects the changes they made

On 4/4/2018 at 9:00 AM, Kewl said:

Hotmail changed its handling of incoming email about a week or two ago. It is messing up the parser.

It is not feasible for SpamCop to adjust the parser to deal with every change made to other's email software. Hotmail, among others, are not really too interested in how they affect other applications. Their interest is in providing (free) email service to their clients, so the client data, usage, networks are available to scrape.

Share this post

Link to post

Share on other sites

#metoo - I sometimes have unwanted email arrive at my outlook email account that apparently arrives from yahoo or google, yet the parser decides to use the MSN reporting address. It's annoying having to do so, but when I spot such an email, I uncheck the report to hotmail, and fill in an appropriate abuse address for user submitted reports.

Share this post

Link to post

Share on other sites

Actually the way I'm reading things Microsoft is the cause of the problem in the first place so in addition to manually determining and reporting to the actual source ISPs of the spam messages I'm also leaving the check mark on to submit to the incorrect MS spam reporting address as well. The intention there is for them to notice the error and as a result put some action on to fixing their IPv6 rDNS entries to conform with the standard.